Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
References
Link | Resource |
---|---|
https://github.com/tj/node-growl/issues/60 | Third Party Advisory |
https://github.com/tj/node-growl/pull/61 | Patch Third Party Advisory |
https://nodesecurity.io/advisories/146 | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: hackerone
Published: 2018-04-26T00:00:00
Updated: 2018-06-04T18:57:01
Reserved: 2017-10-29T00:00:00
Link: CVE-2017-16042
JSON object: View
NVD Information
Status : Modified
Published: 2018-06-04T19:29:02.100
Modified: 2019-10-09T23:24:38.987
Link: CVE-2017-16042
JSON object: View
Redhat Information
No data.